Level 6 · In practice

6.1Guided practical cases

Goal: turn technical mastery of PHP into reliable, safe and maintainable production habits.

Estimated time: 14 min · If you only have 5 min: read “The essentials in 30s” + the diagram.

The essentials in 30 seconds

Anchor: a hand-built CRUD chains structure → PDO → authentication → prepared statements → escaping + CSRF → verification.
Scale up: a REST API with a framework grafts Eloquent, JSON endpoints, tokens and tests onto these fundamentals.
Deliver: secrets in environment variables, OPcache, Git + CI/CD all the way to production.

Riad thread — one year on: two projects running in Constantine

Riad, web developer in Constantine, looks back on his two landmark projects of the year: the mini article-management application with user accounts he built “by hand” to anchor the fundamentals, then the Laravel-based products REST API consumed by a separate front end. Both cases below replay his sequence: organise, connect, authenticate, secure, harden, deliver.

Each case follows Context → Steps → Result: replay it on your own projects.

Putting the bricks end to end

The previous levels laid the bricks (language, web, sessions, PDO, OOP, Composer, security, MVC, frameworks, APIs, tests, deployment); here we assemble them under real conditions: starting from a concrete need, we structure, secure, harden and deliver. Two cases played out from A to Z.

Case 1 — A secure hand-built CRUD (mini-application)

Context: Build a small management application (an article list with user accounts) in plain PHP “by hand”, to anchor the fundamentals before frameworks.

Déroulé :

Organise (N2.3): file structure (config, header/footer, pages), a single entry point, secrets out of the repository (environment variables).
Connect the database (N3.1): centralised PDO (exception mode, UTF-8), an articles table and a users table.
Authenticate (N2.2): sign-up/sign-in with hashed passwords (password_hash), regenerated session, protected pages, authorisation (each user their own articles).
Secure CRUD (N3.1): create/read/update/delete via PREPARED STATEMENTS (never concatenation).
Secure display and forms (N3.4): htmlspecialchars on display (XSS), CSRF token in forms, server-side input validation.
Verify: no concatenated data in SQL, no unescaped data displayed, secrets out of the code.

Result: A working and SAFE mini-application (CRUD, accounts, prepared statements, escaping, CSRF) — fundamentals mastered, a foundation for using a framework well afterwards.

Case 2 — A REST API with a framework (Laravel)

Context: Expose a REST API for a resource (products), consumed by a separate front end or a mobile application, with token-based authentication.

Déroulé :

Set up the project (N3.3/N4.2): Laravel via Composer, MVC structure, migration for the products table.
Model (N4.2): a Product Eloquent model (ORM — objects instead of SQL, automatic prepared statements).
REST endpoints (N4.4): GET /api/produits (list), GET /{id}, POST (create, 201), PUT (update), DELETE — JSON responses, correct status codes.
Authenticate (N4.4): tokens (JWT / the framework's API auth system), verified on each request; HTTPS mandatory.
Harden (N4.5): input validation, clean error handling (codes/JSON), tests (PHPUnit) on the endpoints.
Deliver (N5): config/secrets via environment variables, OPcache, deployment via Git + CI/CD (tests before deployment).

Result: A structured, secure (tokens, HTTPS), tested and deployed REST API — the central deliverable of modern architectures (separate front end, mobile), leveraging the framework's productivity and security.

Common misinterpretation: “copying the cases identically”. No. The cases show an assembly order (organise, connect, authenticate, secure, harden, deliver), not a recipe to copy: reuse the order, adapt the resource, framework and hosting to your project.

Text version of the diagram (SEO / screen readers / translation): Full chain: 1) Organise (logical files, entry point, secrets out of the repo). 2) Connect (centralised PDO, exception mode, UTF-8). 3) Authenticate (password_hash, regenerated session, authorisation). 4) CRUD with prepared statements, escaped display, CSRF. 5) Verify (zero SQL concatenation, zero raw display). 6) Industrialise (Laravel, Eloquent, JSON endpoints, tokens, PHPUnit) then deliver (environment variables, OPcache, Git + CI/CD). Lesson: hand-built fundamentals make framework use safe, not the other way round.

Ready-to-say script — framing a PHP project before coding (30 s)

“Our need: [article management with accounts]. Our foundations: [PDO + prepared statements + escaping + CSRF]. We organise the files, hash the passwords, verify before moving to the framework, and deliver through to deployment.”

Copy-paste template — secure reading and display (PDO + escaping)

 PDO::ERRMODE_EXCEPTION]
);
$stmt = $pdo->prepare("SELECT id, titre FROM articles WHERE user_id = :uid ORDER BY id DESC");
$stmt->execute(["uid" => $utilisateurId]);
foreach ($stmt as $article) {
    echo "" . htmlspecialchars((string) $article["titre"], ENT_QUOTES, "UTF-8") . "";
}

VSE / small budget

A single case replayed on a simple need: single-resource CRUD, shared hosting, direct Git deployment.

SME Constantine

Adapt deployment to local realities: available host, activity peaks, backups and a named contact.

Remote / hybrid

Double traceability at a distance: documented environment variables, CI/CD pipeline and written access.

Intercultural

Check local practices before transposing a case: labels, roles and authorisation rules must speak to the team.

Caution: General reminder: secrets (database passwords, keys) and user data engage your liability — put them in never-versioned environment variables, regenerate any exposed key and have the designated contact validate; this guide gives no legal advice.

48h challenge — apply tomorrow

Take 1 real project and write its 6-step chain (organise → connect → authenticate → secure → harden → deliver). Identify the next step.

Section exit checklist

I can assemble the bricks into a complete application, by hand then with a framework.
I have a replayable PDO + escaping template for my project.
I did the 48h challenge or scheduled its date.

Self-assessment 1-5: chaining the steps?security and delivery covered?

Next : Express troubleshooting (V3) →

Check your understanding

Riad is building his hand-built article mini-application. Which sequence follows the guide?